Your Low-Risk Vendor Just Had a Breach. Now What?

A risk score is a warning. The contract is your leverage.

Vendor breaches are in the news every week, and AI is widening the openings. Every AI tool and agent connected to a vendor’s systems is one more way in. Hosting providers, payroll processors and software companies with strong security programs have all disclosed breaches. If it can happen to them, it can happen to any vendor on your list.

Picture the call after it happens. The assessment on file was clean. Then legal pulls the agreement and finds the vendor only has to notify you “without undue delay,” the liability cap is 12 months of fees on a contract worth a fraction of the exposure, and the vendor’s insurance requirement lapsed with the last renewal. None of that was in the risk score, and all of it was signed.

Third-party risk management is under pressure. Vendor networks keep growing, regulators expect stronger oversight, and the business wants vendors onboarded faster. Much of the current guidance on bringing AI into risk programs reaches for the same answer. Use AI to speed up questionnaires and evidence review, so analysts can spend their time on the vendors that matter most.

That’s a sound instinct. But look at what gets reviewed. SOC 2 reports, ISO certificates, security questionnaires and policies. Those documents describe what a vendor says it does. None of them describe what the vendor is obligated to do, or what happens if it doesn’t.

That’s the contract’s job. And in most risk programs, the contract sits outside the workflow.

Evidence Is Not Obligation

A strong assessment tells you a vendor has good controls today. It doesn’t tell you whether your agreement

• requires the vendor to notify you of a breach, and by when
• gives you the right to audit, or at least to receive audit results
• limits which subprocessors can touch your data
• caps the vendor’s liability at a level that matches the risk it creates
• requires insurance that would actually respond to a loss
• restricts the vendor from using your data to train its own AI models

If the answer to any of these is “no” or “we’d have to check,” the risk score is incomplete. A vendor can look low-risk and still leave you with no leverage when something goes wrong. A vendor can look high-risk and be well covered by the paper you signed. You can’t tell the difference from the assessment alone.

For some companies the stakes are set by regulators as well. Banks, insurers covered by New York’s cybersecurity rules, and financial firms under the EU’s Digital Operational Resilience Act are expected to have specific terms in the contract itself, not just a clean assessment on file.

Why Contracts Get Skipped

Contract review is slow, specialized and usually owned by someone other than the risk team. At onboarding it’s often the step that stalls the vendor, so it gets rushed. For the contracts already signed, it rarely happens at all. They were negotiated under different standards, by different people, in different years, and most haven’t been reread since.

The result is a gap between the risk program and the legal reality it depends on. I’ve worked on both sides of that gap, inside companies managing large supplier bases and as the advisor called in after something went wrong. After an incident, the question isn’t what the questionnaire said. It’s what the contract lets you do.

What a Contract Read Adds to a Risk Program

Read against a full standard, each vendor agreement shows which terms it meets, misses or falls short on, with the evidence cited and the fix drafted. In a third-party risk program, that supports five jobs.

1. Check the promise against the paper. Compare what the assessment tells you with what the contract actually requires, and find the vendors where the two don’t match.
2. Move faster at onboarding. Run the contract review alongside the risk assessment so the two finish together, instead of one waiting on the other.
3. Audit the vendors you already have. Read the executed agreements once, against one standard, and get one picture of which vendors have no breach notice, no audit right, no limits on subprocessors or AI use, and where liability and insurance don’t match the exposure.
4. Cover the AI question the frameworks skip. Most guidance is about using AI inside your risk program. Far less addresses what your vendors do with AI on your data. That’s a contract question.
5. Answer your own customers’ reviews. The same read runs the other way. When you’re the vendor, your customers’ risk teams are asking these questions of your paper. Knowing your own contracts’ answers before they ask shortens the security review and keeps every concession deliberate.

Where to Start

You don’t need to rework your program. Pick the vendors in your highest risk tier, or the ones that haven’t been reviewed in the longest time, and read their contracts against your standard. A sample of 20 to 50 agreements is enough to show where your paper and your risk ratings disagree. Most teams find they know their vendors’ controls far better than their vendors’ commitments.

Building the Contract Side of Your Risk Program

Revver puts the contract side of a third-party risk program in place as one piece of work. Our Advisors, the Portfolio Audit and Revver Contract Intelligence each do the part they’re built for. Any one of them can help on its own. Together they get you to a program where every vendor in scope has been read against your standard, the gaps are being closed, and the evidence is on file when a regulator or auditor asks.

1. Set the Standard

Our Advisors work with your risk, legal and procurement teams to set the contractual protections your program requires for each vendor tier. They start from RCI’s standards library, so the terms above are covered from day one.

• Breach notice. Earliest Credible Incident Notice, Tested Response and Funded Investigation checks when the vendor has to tell you, what starts the clock, and who pays for the investigation.
• Audit rights and the assurance behind the score. Buyer Verification and Audit Rights checks what you can inspect. Defined Security Controls, Scoped Independent Assurance and Controlled Changes checks that the controls are written into the agreement and that the vendor’s independent assurance covers the service you’re actually buying.
• Subprocessors. Material Subcontracting, Delegation and Downstream Accountability checks who else touches your data and whether the vendor stays accountable for them.
• Liability and insurance. Completed Liability Limits, Loss Pools and Recovery Capacity checks whether the cap is sized to the exposure. Risk-Selected Insurance, Actual Coverage and Continuity Evidence checks that the coverage would respond to the loss and stays in force.
• AI and your data. Prohibition on Training with Protected Buyer Information and Approved AI Use in Supplier Delivery check whether the vendor may train on your data and which AI tools it may use to serve you.
• Regulated relationships. Where the facts call for them, the standards for NYDFS Third-Party Cybersecurity, US Bank Service Provider Terms and EU DORA ICT Third-Party Terms check the terms a regulator expects to see.

Your team ratifies the result. From then on, every review in the program is measured against the same standard, whoever runs it.

2. Read the Book You Already Have

The Portfolio Audit is a fixed-fee engagement that reads your executed vendor agreements against that standard, starting with your highest-risk tier. Each agreement is read with its order forms, amendments and data protection terms as one family, so a protection the master agreement gave you and a later document took away shows up. You get every finding with the contract language behind it, a vendor-by-vendor view of which protections are missing, the renewal and notice dates for each agreement, and a prioritized action plan. Where the scope calls for it, the Audit also delivers a compliance report against a specific regulation and board-ready reporting.

3. Close the Gaps

A list of gaps doesn’t reduce risk until someone goes back to the vendors. Our Advisors run that remediation on your behalf or alongside your team, with the replacement language already drafted and a position for each ask. They time each conversation to the vendor’s renewal and notice dates, when you have the most leverage, and every concession and exception is recorded with who agreed to it and why.

4. Hold the Line on New Vendors

New vendor agreements go through RCI as part of onboarding, alongside the risk assessment, so the two finish together. Every finding is ranked Must, Should or Nice to address and comes with the language to send back. Escalations reach legal with the clause, the standard and the drafted ask already attached. Each review produces a Review Receipt listing every standard checked, including the ones the agreement met, which goes in the vendor’s risk file as evidence.

5. Keep It Current

When a regulation or internal policy changes, add the requirement to your standards and RCI reads the book against it, showing which agreements already meet it and which don’t. The renewal calendar keeps every notice window in front of the people who need it. The vendor view ranks your vendors by the findings that must be addressed, the same number that appears on every report. And because RCI is built API-first, with an MCP server for AI tools, the contract findings can flow into the risk platform you already run. RCI doesn’t replace that platform. It gives it the contract side it has been missing.

And When You’re the Vendor

The same program runs from the other side of the table. RCI’s sell-side library reads your own paper from your position, with standards such as Breach Notice Timing and Control, Audits Through Reports First, and Data-Breach Liability Under a Defined Super-Cap, so you know your answers before a customer’s risk team asks.

Risk scores tell you where to look. Contracts tell you what you can do when you get there. A mature third-party risk program needs both, and the people to act on what it finds.

Revver Contract Intelligence is an AI-native platform that evaluates a company’s contracts from its own position, turning the judgment behind every decision into institutional knowledge that compounds over time.